mcbridematt.dhs.org

libnfc is a library for communicating with ISO14443 RFID tags. You might know these things for their use in smart card ticketing systems such as Oyster, Octopus, Snapper and myki. But they are also present in other forms such as photocopy cards, student ID's, building access controls* and passports. Two forms of ISO14443 dominate: Felica, which debuted in Hong Kong's Octopus RFID ticket and spread across Asia soon after, and Mifare, which dominates just about everything else.

Full tutorial below the fold

A double post for today.

Wednesday

Thursday

• Keynote: Glyn Moody

  Discarding data for fun and profit

  Yubikey authentication in a mi4>d-sized organization

  So you moved the graphics drivers to the kernel, so what? i can haz ponies

  Tux on the moon: FOSS hardware and software in space

On my list for today:

• Keynote: Gabriella Coleman
• System admin: Weta Digital: Challenges in data centre growth
• System admin: System deployment and bare metal recovery with Clonezilla
• Data storage: Relational vs Non-Relational
• Data storage: How to create a full text search solution with MySQL
• Sys admin: Linux containers, virtualization with out strange patches
• Sys admin: Being lazy in a large organization - documentation by wiki
• Data storage: Build your own dropbox

Read on for my reviews

Welcome to my liveblog of linux.conf.au 2010, in Wellington NZ. I hope to do a round up at the end of each day, and post my presentation picks at the start of the day.

For Monday, the 18th:

• OPLM: Haskell and the wonderful things it doesn't let you do
• OPLM: Introducing gearman: the distributed server for all languages

• Open business: Getting your personal financial house in order with gnucash
• Arduino: Flex and the arduino
• Open wave: Google wave and web 2.1
• Hackers, Crackers and Security basics
• Arduino: Memory architecture of AT mega CPUs
• Arduino: The RepRap, Arduino in 4D

Hit "Read more" for my impressions of these talks

I used to be a prolific blogger, having blogged almost every third day for a number of years. Unfortunately, that slowed since 2006, for a number of reasons, mostly time, software and the rise of "social networking"

Not anymore.

For three months on and off, I have been building the Really Awesome Blogging Software Solution™ I wanted something that suited my vision, and now its here

Hit 'more' to read about what powers this new website

This blog was the first C++ project I have done from scratch (as opposed to hacking on existing projects like I have done before), that served a functional purpose.

One of the features of C++ is that it gives "choice"; one could write programs in either procedural or object oriented style. Object oriented is popular: Java, C++, Python, Ruby, C# and Objective-C just to name a few are object oriented languages. Meanwhile, C (which C++ extends) is a procedural language.

Lesson #1: "Pick a side"!
Writing parts of the software outside class objects simply broke my work flow later on, trying to context switch between two different modes of operation. Sure, in these cases the functions involved had no need to be wrapped in objects, but it proved better to make them into static class methods.

There isn't anything wrong with procedural programming in general, it just makes it easier for you to shoot yourself in the foot. A well designed procedural API makes it easy to create and do operations of data. One well designed example is CFString in Apple's CoreFoundation which really beats working with C's <string.h> any day of the week

Lesson #2: Abstract early and often
This is probably the most important lesson out of all. Early on I had built the blog post and comments view by simply extracting data from the DB at those points. No attempt to wrap the data in an object was made. Then I had to access that data elsewhere within the application, sometimes operating on one object or operating on several. So I finally built an OOP interface there. Had I done it right away in prototype stage I would've saved time.

The object models proved much better to work with in the end

Lesson #2.1: Model-View-Controller rules. Use it
This goes with the above, once Model and Controller are sorted, adding more functionality (i.e different ways to get data) by creating more views is trivial.

Myki is supposed to be Victoria's new contact-less public transport ticketing system, uniting various solutions in use across Victoria (Metcard, V/Line, regional bus tickets)

It has been rolled 'outside-in' from Geelong and other regional centres. The physical aspects have been around for a long time (metal posts at train stations, 'brochure holder' stubs on trams and busses), but the project is only being delivered to the public now

While I look forward not having to rummage around for a coins yet alone keeping a flimsy paper ticket when using the bus in Geelong, I've heard so far the hardware hasn't been reliable at all times. Hopefully the hardware showing up in Melbourne has bugs fixed.

And now, for the technical aspects:

• The letter I got with my card claims they don't hold any personal data beyond 30 days from ordering, unless I register it on their website
• A flimsy Short term ticket exists
• Myki is based on Mifare hardware, which is industry standard (good since the state could switch to another supplier). Reportedly, Myki is based on the newer DesFire version, not the Mifare classic which has been cracked several times in recent years
• Contact-less ticketing using similar (MiFare) hardware exists in places like London (Oyster), Perth (SmartRider), Queensland (TransLink Go). Sydney tried with Tcard, and failed due to complexity. Hong Kong has had a contact-less system (Octopus) since 1997
• A vendor report regarding a pilot conducted with McHarry's Buslines in Geelong, April 2008 reveals some technical details about the Myki system in an appendix regarding issues raised during the pilot:
  • Rather standard mobile hardware has been used in the buses (and probably trams). WiFi is used to transfer data back at the depot, the driver console runs some variant of Windows (probably CE) and the storage is CompactFlash
  • Some rather interesting issues raised as a result of network issues( DHCP), application crashes ('BDC.exe'), application freezes, pulling circuit breakers to reset the entire system (no 'big red button' exists apparently), Windows based webservers
• Everything seems to be connected to some big private Myki network. Shots of myki related network hardware: 1 (from calt of RP), 2 (from Marcus Wong) - hmm, thats some old Cisco kit, plus several in this Seven News story (anyone got a HD capture?)
• Hope those guys have WPA on. And I guess every single loading transaction online/from the phone is going to be synced to every single Bus/Tram console every night - how long will that take (probably more processor intensive), what happens if data is not synced properly? Having the stored value of Myki under say $10 may be risky
• There is fibre along each rail line in Victoria, generally used for signalling, presumably what the Cisco gear and big steel cabinents linked earlier are connected to, along with the train station scanners. (picture from cookies930 of RP). Will all this connected gear operate autonomously in case of network outage? What will happen at Flinders Street in peak hour if an outage happens?
• (In Singapore they sell a USB card reader so people can top up their cards instantly. I wonder how that goes for security?)
• According to Victorian Fare policy manager Adrian Web, 7-11's point of sale hardware already has the appropriate MiFare hardware in for reloading Myki, negating the need for additional hardware (see link below)

Additional reading:

• Railpage Australia Forum - Myki, Includes some posts from Victorian fare policy manager Adrian Webb ("Revenue"). Pictures above (apart from the two at the start) have been sourced from there
• Marcus Wong's gallery
• MiFare Classic attacks (not relevant to Myki, but give idea of how Myki could be cracked if we ever get hardware fast enough to crack DES):
  • Walk up to reader or 'bum-sniff' user attacks (Youtube video) and report (PDF)
  • CCC 2007 presentations
  • "A practical attack on Mifare Classic" - Gerhard de Koning Gans
  • Public transport cracking in general: the DEFCON 08 presentation that was stalled by Boston's Public transport operator in court (they use Mifare). Details social engineering, Mifare attack, brute force, physical access to network hardware (hmm.. Myki)
  • Vendor statement on Mifare classic attacks

You can send SIGQUIT (kill -3) and the JVM will produce a stack trace of all threads in the JVM. Sweet!

Does my arse look big in this? [a late arrival comes into the theatre] DOES MY ARSE LOOK BIG IN THIS? [to late arrival] WELL BOY THATS THE LAST TIME YOU ARRIVE LATE TO A THEATRE!

Vamp is a very interesting piece. The term Vamp refers to a popular image of a Femme Fatale character. Here we see something loosely based around people such as Mata Hari.

You may think the name of the show implies some sort of serious drama; hardly. Vamp is a one and a half hour cabaret-style performance featuring performer Meow Meow (no actual name supplied). To me her sound isn't new; its like a matured Dresden Dolls (who, conincidentally, she has toured with).

Vamp contains mostly original work by Meow Meow and experianced composer Iain Grandage. The show is mostly set in a gothic 20th century Europe as the character of Vamp describes her adventures and encounters (with men, err clients).

But song isn't the only thing you'll see. This is a cabaret after all. The intimate setting of the show means she is performing for us. Those in the front row around the stage got the value of their ticket and then some.. (I won't spoil it). There was a very well done aerial performance, and the rapport with the audience was great.

Vamp isn't a performance for big babies though. The story line does slow down near the end but Meow Meow makes up for it afterwards. It would be best enjoyed with alcohol, or perhaps even absinthe. And the young and uneducated like me won't necessarily get everything in it; the woman sitting next to me, and a good portion of the audience for that matter seemed to crack up at everything.

Vamp finishes this Saturday the 20th of September at the Malthouse but moves on to the Sydney Opera from the 24th to the 5th. (and as an aside; I hope they do a cast recording of this show on CD)

Promotional image shamefully stolen from Malthouse website